1. Field of Art
The present invention relates generally to the field of network and application management of computer networks, and, more specifically, to the field of monitoring networks.
2. Description of the Related Art
Today's computer networks are extremely complex with hundreds of applications, thousands of servers, hundreds of locations, hundreds of thousands of clients and traffic routed by numerous switches and routers on local area networks (LANs) and wide area networks (WANs). Detection of network faults and performance problems become very critical to have an efficient working environment. However, it also becomes very difficult because there is no commonly accepted operational definition of the baseline of a given measure.
A conventional moving average is often used as a baseline. In this approach, a baseline value is an arithmetic average of measured values within a fixed time window. Since baselining is to show a relatively short term behavior, the number of data set inside the window is small and the data distribution usually has a very large variance. The arithmetic average is not a good estimate of the expected value (or mathematical expectation) of a measure, which is also called the population mean. In other words, the baseline value obtained by using this sample mean can be very misleading (e.g., inaccurate), and an inner band and outer band based on the sample mean and sample variance may become meaningless due to an unknown sample data distribution with a large variance of the network traffic measure.
From the above, there is a need for a system and process to provide a baseline that handles a large variance in a data distribution with a limited number of samples.